Public/Private

Mierdin

I'm confused by the whole Public/Private key concept - my resource says that if the Public Key is used to encrypt, then the Private key is used to decrypt. Conversely, if the Private Key is used to encrypt, then the Public Key is used to decrypt.

Since the public key is known by everyone, how is this secure? Let's say the public key is used to decrypt the data, which means the private key was what encrypted it. Can't I just snag the public key and hijack someone else's data? To what point is the public key "public"?

Any clarifications would be helpful.

101010

The way I understand it, it comes down to how you want to use them. If you make a key-set, and decide to make the the "Encryption Key" the Public one, then you will be the only one that can decrypt the given data. This is useful when you want to ensure data sent from one location to another will arrive without anyone else being able to know what it contains.

Now when you make the Decryption Key the Public one, this means anyone can read what you encrypted with your private key, but you are the only one with that key. So it can be used as a form of authentication.

You then can turn around and use several key-sets in conjunction, some for secure communication, others for authentication purposes.

As a warning, I am studying for the Sec+ myself, so this explanation my not be entirely accurate. If at all

zaxbysauce

Anything encrypted by your private key can be decrypted by your public key, however something encrypted by your public key can ONLY be decrypted by your private key. So generally someone would take a symmetric key such as AES256, encrypt it with your public key, and then send it to you knowing that only you could decrypt it. You would then communicate from that point on using the AES key provided. Most of the time asymmetric keys are used for the transmission of symmetric keys.

zaxbysauce

As another example let's take a look at Digital Signatures for email. The process generally works like this.

1. The email is sent unencrypted.
2. Attached to the email is a hash of the email encrypted with the sender's private key.
3. The recipient gets the sender's public key via the Global Address List and unecrypts the hashed message. The recipient then hashes the original message and sees if the two match.
4. This not only shows that the data has not changed during transmission, but it also proves it came from who it says it came from.

That is just one of the many uses of public/private keys.

Mierdin

Thanks for the clarification. It helped a lot.

On that note, I passed the Security+ exam. Thanks again for the help.

Devilsbane

Congrats. If you are still confused, Darril Gibson's book has a great explanation using a "real life" example in his book called the Rayburn Box.

Here is a youtube video that claims to talk about it (didn't get a chance to preview at work)

Security+ Encryption - YouTube

Maverick918

Public and Private are completely separate. So check this out.

You got Jack and Jill right. Jill wants to send Jack a message so she requests he send his public key. Jack being inquisitive sends over his public key and Jill encrypts her super secret message with it. Now nobody besides Jack on this earth can decrypt Jills message (not even Jill) because it can only be decrypted by Jacks Private key.

Hope this helps.